Welcome back to this sixth installment of Devine Guidance. I am not one to assume a Panglossian view (time to pull out the dictionary again) when dealing with problem suppliers and the need to pursue corrective action. However, at times the ugly SCAR becomes unavoidable. In fact, evidence of effective corrective action, as it pertains to suppliers is a requirement and the FDA, notified bodies, and other regulatory bodies will verify the effectiveness of the approach pursued by your organization. Additionally, the SCAR becomes one of the metrics employed to gage overall supplier performance.

As for the Devine Guidance Rules, they are premised on common sense and capture the effulgence of this author, on his good days.

Warning letter violation
For this installment of Devine Guidance, I have taken the liberty of depicting a warning letter that was issued in January 2010, because it contains two salient points. The first point reflects the overall lack of a documented procedure, and the second point is no evidence of training. Now, from my vantage point, it would be difficult to defend having a phantom training record as evidence of training in accordance with a phantom corrective action policy. In this case, the two wrongs do not equal a right. Instead, they equal a warning letter.

Failure to establish and maintain procedures for implementing corrective and preventive action (CAPA). 21 CFR § 820.100(a).

Specifically, your firm has no CAPA procedures that include requirements for analyzing processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, or other quality problems.

We have reviewed your responses pertaining to CAPA procedures and have concluded that they were inadequate because of the following:

a. Your CAPA procedure, Revision A, does not specify that you will verify or validate the corrective and preventive action to ensure that such action is effective and does not adversely affect the finished device as required by 21 CFR § 820.100(a)(4). For example, your firm needs to perform effectiveness checks in order to verify that the corrective and preventive actions were effective as to the intended purpose of the action and that new issues or concerns are not introduced.

b. No training records were provided to show that your CAPA procedures were implemented and are being followed by your firm.

Regulations and requirements
The regulations are clear as they pertain to pursuing corrective action. Key regulations providing oversight are:

1. QSR – Subpart J – Corrective and Preventive Action:

Section 820.100

a) Each manufacturer shall establish and maintain procedures for implementing corrective and preventive action. The procedures shall include requirements for:

(1) Analyzing processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, or other quality problems. Appropriate statistical methodology shall be employed where necessary to detect recurring quality problems;

(2) Investigating the cause of nonconformities relating to product, processes, and the quality system;

(3) Identifying the action(s) needed to correct and prevent recurrence of nonconforming product and other quality problems;

(4) Verifying or validating the corrective and preventive action to ensure that such action is effective and does not adversely affect the finished device;

(5) Implementing and recording changes in methods and procedures needed to correct and prevent identified quality problems;

(6) Ensuring that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring the quality of such product or the prevention of such problems; and

(7) Submitting relevant information on identified quality problems, as well as corrective and preventive actions, for management review.

(b) All activities required under this section, and their results, shall be documented.

2. MDD (Please note the MDD references EN ISO 13485, the Harmonized Standard for Medical Device Quality Management Systems)

Article 3 – Essential Requirements
The devices must meet the essential requirements set out in Annex I, which apply to them, taking account of the intended purpose of the devices concerned.

Where a relevant hazard exists, devices, which are also machinery within the meaning of Article 2(a) of Directive 2006/42/EC of the European Parliament and of the Council of 17 May 2006 on machinery shall also meet the essential health and safety requirements set out in Annex I to that Directive to the extent to which those essential health and safety requirements are more specific than the essential requirements set out in Annex I to this Directive.

Annex II.3 EC Declaration of Conformity – Full Quality Assurance System
The manufacturer must ensure application of the quality system approved for the design, manufacture and final inspection of the products concerned, as specified in Section 3 and is subject to audit as laid down in Section 3.3 and 4 and to Conformity surveillance as specified in Section 5.

EN ISO 13485 – 8.5.2 Corrective Action
The organization shall take action to eliminate the cause of nonconformities in order to prevent recurrence. Corrective actions shall be appropriate to the effects of the nonconformities encountered. A documented procedure shall be established to define requirements for:

1. reviewing non-conformities (including customer complaints),
2. determining the causes of nonconformities,
3. evaluating the need for action to ensure that nonconformities do not recur,
4. determining and implementing the action needed, including, if appropriate, updating documentation,
5. recording of the results of any investigation and of action taken, and
6. reviewing the corrective action taken and its effectiveness.

EN ISO 13485 – 8.5.3 Preventive Action
The organization shall determine action to eliminate the causes of potential nonconformities in order to prevent their occurrence. Preventive actions shall be appropriate to the effects of the potential problems. A documented procedure shall be established to define requirements for

1. determining potential nonconformities and their causes,
2. evaluating the need for action to prevent occurrence of nonconformities,
3. determining and implementing action needed,
4. recording of the results of any investigations and of action taken, and
5. reviewing preventive action taken and its effectiveness.

Supplier corrective action requests
So, why are SCARs important? For starters, the SCAR becomes the primary vehicle for driving corrective action when issues arise with your supplier base. Remember, FDA is concerned about the rising number of recalls premised on supplier-related issues. In the May 2007 edition of The Sheet, Kim Trautman (FDA QSR Expert) expanded on the increasing number of recalls driven by poor supplier performance. Additionally, the SCAR becomes an important metric when measuring the overall performance of your suppliers.

It might seem daunting to issue a SCAR for every single supplier error, regardless of how benign; however, you can defend having a two-tier SCAR system. The first category is “Response Required,” and the second category is “For Information Only.”

What is the difference? For serious non-conformances, such as dimensional issues, repeat failures, lack of supplier responsiveness, degradation in supplier yield or performance, you are going to want detailed responses that provide insight into performance issues or non-conformances. For example, you will want the supplier to acknowledge the performance issue or non-conformance, address previous, current, and future impact from the performance issue or non-conformance, perform a detailed root-cause analysis, and very important, ensure a follow-up is performed to determine the effectiveness of all corrective actions pursued.

For minor annoyances such as, the wrong quantities delivered, torn or damaged certificates of conformance, damaged packaging not affecting the procured product, or similar non-frequent non-conformances that do not affect product performance (e.g., form, fit, or function), the “For Information Only” category doubles as a nice little love letter to your supplier acknowledging that you have identified a minor issue. However, if you issue several of these love letters, to the same supplier, you just might have a significant performance problem that now requires a response. Regardless of the SCAR approach, please ensure you clearly document the rules in a SCAR procedure (in accordance with Devine Guidance Rule #6).

One part of the SCAR process you should never take for granted is the follow-up. Sure, your supplier is going to make an honest attempt to fix and resolve all non-conformances; however, as a medical device manufacturer it is your responsibility to verify the corrective action implemented is effective. Additionally, when employing a “Response Required” SCAR, ensure the supplier clearly understands the problem, your expectations for a solution, due date, and other relevant information. Furthermore, make sure the supplier actually receives the SCAR. If necessary, obtain a signature or some other proof of delivery. A follow-up telephone call, documented of course, is also recommended.

Finally, a SCAR is a supplier metric. It should be tracked and aged accordingly, with the information presented in your management review, and the information shared with the supplier as part of their quarterly review. In the next edition of Devine Guidance, I will review the value and importance of supplier metrics.

Some key components of the SCAR form are:

1. The SCAR tracking number;
2. The date the SCAR was issued;
3. SCAR type (Information Only or Response Required);
4. The date the SCAR response is due;
5. The supplier name, address, point of contact, etc.;
6. The purchase order number or other relevant documentation;
7. A clear description of the non-conformance or performance issue;
8. Preventive and corrective action taken by the supplier;
9. Appropriate signatures, approvals and dates of the issuer and the supplier;
10. A section for follow-up to determine effectiveness of action pursued; and
11. Signature of approver and date SCAR was approved (or rejected).

Devine Guidance rules
Every organization establishes common sense rules to ensure their organization remains on the straight and narrow path and complies with the various regulations. Believe me, the medical device industry grows more complex by the day due to the ongoing evolution of regulations. For example, we are all familiar with the MDD, the QSR, EN ISO 13485, CMDCAS, TGA, and the growing list of country-specific requirements. Each of these regulations and standards contains its own little nuances that are mandatory requirements.

That being said, it is impossible for a single individual, including me, to have all of the answers, so when in doubt, find one of the regulation-specific experts, and ask. The rules listed below are premised on common sense and are not all encompassing; and remember if you cannot sit across from a regulatory body during an investigation or audit, without laughing hysterically while defending your quality  system, you are probably not pursuing an above-board path toward compliance.

Finally, if you do not like rules then picture yourself or your senior quality or regulatory person wearing an orange jumpsuit. That is what the future holds for individuals and organizations that willfully and egregiously violate the QSR.The Devine Guidance Rules for Quality and Compliance are:

Rule #1: Compliance to regulations is not optional it is mandatory and dictated by law.

Rule #2: Measuring and monitoring equipment shall be calibrated, maintained, and traceable back to a recognized standard, e.g. the National Institute of Standards and Technology (NIST). 

Rule #3: Document the results of all events in writing, because if it is not documented in writing, the event did not occur.

Rule #4: FDA conducts investigations for collecting evidence, should legal action be required; while your notified body (remember they work for you) conduct audits. Treat each visit accordingly.

Rule #5: All investigations, CAPA, Response Required SCARs, product failures, audit findings, etc. require root-cause analysis and follow-up for effectiveness of the actions pursued.

Rule #6: All procedures, work instructions, drawings, specifications, etc. must be written, well-documented, and controlled within a defined document control system.

Rule #7: Make sure all changes, design, process, supplier, etc. are processed through the appropriate level of validation.

Rule #8: Clearly mark and segregate all non-conforming material, preferably under lock and key.

Rule #9: Management review is an important tool employed to gage the effectiveness of your entire organization, not just quality; so ensure all of the metrics employed to monitor your business are included into the review.

Rule #10: Effective design control is not an option it is a salient requirement.

Rule #11: Never have your quality or regulatory organizations report into manufacturing operations; remember the separation of church and state rule.

Rule #12: Traceability is required from start to finish for everything, i.e., production, process validation, design validation, aging studies, etc.

Rule #13: When in doubt, read the appropriate regulation, contact your notified body, talk with your quality organization or regulatory organization, and finally, ask for Devine Guidance. 

Common sense needed when developing and executing quality systems
In wrapping up this installment of Devine Guidance, I again thank you for joining me.

One thread that links my writing and ranting is the need for common sense when developing and executing your quality systems. All though the medical device industry grows increasingly complex, compliance is actually premised on doing the right thing, all of the time. That being said, a SCAR is an effective tool to assist in resolving a multitude of supplier issues. The goal is to quickly resolve supplier issues and move forward. As for my rules, you could probably come up with dozens of your own. Once again, the approach pursued is the employment of common sense to achieve compliance.

Until next time, best wishes from Dr. D.

References:

1. Code of Federal Regulation. (2008, April). Title 21 Part 820: Quality system regulation.  Washington, D.C.: U. S. Government Printing Office.
2. Devine. C. (2009, July). Exploring the effectiveness of defensive-receiving inspection for medical device manufacturers: a mixed method study. Published doctoral dissertation. Northcentral University. Prescott Valley, AZ.
3. FDA – U.S. Food and Drug Administration Website. (2010). Warning letters. Retrieved February 12, 2010, from http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/.
4. Medical Device Directive. (1993). Council Directive 93/42/EEC. Medical Device Safety Service. Retrieved January 11, 2010, from http://www.mdss.com/MDEV/93_42_EEC.htm. 
5. Medical devices – quality management systems – requirements for regulatory purposes. (2007). EN ISO 13485:2003/AC:2007.
6. Poor supplier control causing recalls, FDA says; contract is key to success. (2007, May). The Sheet – Medical Device Quality Control, 11(6). Danvers, MA.